JCPNet Tool and Automated Analysis of Distributed Systems ABSTRACT

JCPNet Tool and Automated Analysis ofDistributed SystemsXiaochuan Yi and Krys J. KochutDepartment of Computer ScienceThe University of GeorgiaAthens, GA 30602-740101-706-5830613{xyi, kochut}@ABSTRACTModel based approach is crucial to the analysis of system design. Colored Petri Nets (CPNet) have been used as software model with good success. It can be used to complement UML diagrams by providing formal modeling and analysis of dynamic behaviors of distributed systems. In order to enable CPNet model to be utilized more flexibly and widely, a new software tool JCPNet has been developed. This paper discusses the background, motivation and development of JCPNet, and its applications to specification and analysis of distributed systems.Categories and Subject DescriptorsCategories and Subject Descriptors: D.2 [Software]: Software Engineering - Design Tools and Techniques; Petri nets; G.4 [Mathematics of Computing]: Mathematical Software - Algorithm design and analysis; verification;General TermsAlgorithms, Theory, VerificationKeywordsColored Petri Nets, State space, Occurrence graph, Service-Oriented Architecture, Service composition1.INTRODUCTIONSystem models provide abstractions of a physical system that allow engineers to reason about the system. All forms of engineering rely on models to understand complicated systems. The uses of models include predicting system qualities, reasoning about specific properties when aspects of the system are changed, and communicating key system characteristics among various stakeholders. System models can be developed as a precursor to implementation of the physical system, or they can be derived from an existing system as an aid to understanding its behavior [Intro to MDA].A major advantage of formal modeling is that it allow for formal reasoning. All state-based formal reasoning techniques involve examining every possible state of a system. Such techniques are automatic, thus they can be applied by less trained personnel, for analysis and error detection as well as verification. Therefore they are one of the most promising formal reasoning techniques [Incremental state space].Colored Petri Nets model (CPNet) [Jensen v1] [CPN practioner’s guide] is a high-level Petri net extended with token color, time and hierarchy. It is a graphical formalism suitable for modeling systems where concurrency, synchronization, and communication are key characteristics. CPNets and Petri nets have already been applied successfully to communication protocols, data networks, embedded systems, business process/workflow modeling, and manufacturing systems. Moreover, the use of CPNets spans over many phases of system development ranging from requirements elicitation to design, validation, and implementation [CPN sys dev]. The primary reason for the success of CPNets is because CPNet has a graphical representation, a well-defined semantics allowing formal analysis, and supporting software tools such as CPN Tools [CPN Tools].In our research project on “Specification, Design and Analysis of Service-Oriented Distributed Systems” [atpn], we focus on research issues regarding service composition involving statefulpartner services, such as specification of behavioral interfaces (also called conversation protocols) and compositions. Our underlying specification model is based on CPNet. In certain situations the conversation protocol of a composite service is not easily known before the composition is finished. Therefore we have devised an algorithm that derives the conversation protocol from the corresponding composition automatically. The derivation algorithm is based on a series of CPNet occurrence graph constructions. Unfortunately, the source code of CPNet occurrence graph construction algorithm is not available, which motivates us to create our own data structures representing CPNet model and implement core CPNet algorithms.In order to enable CPNet to be more widely and easily used, the programming language used for CPNet data structures and algorithms must be a widely used programming language. The programming language should also support convenient GUI development and XML processing, so that CPNet models can be efficiently visualized and exchanged in XML documents. Initially C++ had been considered due to the execution speed of compiled C++ programs. Eventually we have turned to Java because class reflection mechanism is provided by Java and its data structures are more flexible. These features are keys to efficient representation of CPNet.CPNet model incorporates certain capabilities of programming language for richer data manipulation, which have enhanced the expressiveness of CPNet model and reduced the model size considerably compared to standard Petri Net [Muruta 89]. The programming language adopted in CPNet is CPN-ML, an extension of function programming language Standard ML [SML]. CPNet elements such as color sets, token variables, arc expressions, transition guard expressions are specified in CPN-ML. Our contention is that the programming language incorporated in CP-net model specification should NOT be confined to one particular language such as SML. Java is one of the most used programming languages; it is platform independent; it provides SDK for efficient GUI development and powerful XML processing. Last but not least, Java is expressive enough to specify CPNet inscriptions as well.Currently the source code of CPNet data structure and algorithms is not freely available in a commonly used programming language such as Java or C++. By providing the CPNet data structure and algorithms in Java, we hope more researchers and programmers will get a chance to look at CPNet model and actually use it. Furthermore, basic CPNet data structures and algorithms can be integrated as APIs, which is more flexible than solely replying on external tools such as CPN tools.Driven by the above motivations, we have developed a new tool supporting CPNet called JCPNet. JCPNet provides a general representation of CPNet model in Java classes and the implementation of a collection of common CPNet algorithms such as occurrence graph construction algorithm [Jensen v2]. Occurrence graph is also known as reachability graph or state space. JCPNet also provides a bundle of example applications: arithmetic adder, dining philosophers, distributed database, resource allocation, and specification and analysis of service oriented distributed systems.The paper is organized as follows: in Section 2 firstly we describe concepts and definitions regarding CPNet, secondly we present an overview of key data structures and algorithms in JCPNet, as well as their relationships to corresponding CPNet concepts. In Section 3, we discuss the importance of state space analysis and CPNet occurrence graph construction algorithm. In Section 4, we present several examples to show the application of JCPNet to distributed systems modeling and analysis. Finally, Section 5 contains concluding remarks and discussion of future direction.2.DATA STRUCTURES FOR CPNET2.1Informal Description of CPNet Structure and BehaviorIn this section, we give an informal description of concepts regarding CPNet structure and behavior. The description is helpful to understand the formal definition of CPNet and our implementation of JCPNet. Readers who are interested in the formal definition of CPNet structure and behavior should refer to [Jensen v1].CPNet is a directed bipartite graph, which has two different types of nodes (vertices): place and transition. An arc (edge) connects from a place to a transition; or from a transition to a place. Data manipulation in CPNets is supported by CPN-ML, which is an extension of Standard ML. A CPNet has a declaration of data types (called color sets), token variables, constant values and functions in CPN-ML. A token variable can be bound to an element of the color set which the variable belongs to. A token is defined as an element of a particular color set. A token variable bound to a value is a token. Furthermore, the declared variables, constants and functions are used to construct CPN-ML expressions, which are used to inscribe places, transitions and arcs of theCPNet. Each place p is mapped to a color set C(p), and p contains a collection of tokens which is a multi-set over C(p). The state of p containing tokens is called a marking of p. The distribution of various tokens all over the places in a CPNet is called a marking of the CPNet. An arc is inscribed with an expression, which evaluates to a multi-set over the color set of its input place when all the variables in the expression are bound to values. A transition has a boolean expression called guard. The collection of variables which occur in the input arc expressions and the guard expression is called the variables of the transition. The pairing (t,b) of a transition t and a binding b of the variables of t is called a binding element. A binding element (or transition t) is enabled when each input place of t contains enough tokens the input arc expression “asks for”. An enabled transition may fire. When the transition fires, firstly the tokens in each input place are consumed according to the input arc expression, secondly new tokens are added to each output place according to the output arc expression. The firing of a transition is deemed as an atomic event, there is no interim marking corresponding to the state when the input tokens have been consumed and output tokens have not yet added to output places.2.2Class Diagram of JCPNetThe UML Class Diagram of JCPNet is shown in Fig. 1, which presents an overview of data structures representing CPNet. With the class diagram, now we describe each class in details. Please note the term “attribute” in UML has the same meaning as the term “class field” in Java, and the term “operation” has the same meaning as the term “class method” in Java.Class DeclarationAn object of class Declaration realizes the declaration of color sets, token variables, constant values, and expressions that will be used in the CPNet. Declaration is an abstract class, it must be extended for each specific CPNet.Sometimes, token variables from different input arcs of a transition are not independent of each other. For example, in the CP-net of Distributed Database (see Fig. x), transition receive has two input token variables: r and mes (mes is pair of (s, r)), and any binding applied to transition receive should always keep r equal to the r of mes. Operation match ( ) method can be override to enforce such a specific constraint when necessary.Class NodeCPNet is essentially a directed bipartite graph which contains two different types of nodes: places and transitions. However, a place and a transition still share some common attributes, which is captured by class Node to encourage reuse.Class Place extends NodeAttribute currentMarking represents the current marking of the place, while attribute initialMarking represents the initial marking of the place. Operation Place ( ) is the constructor of class Place.Fig .1. UML Class Diagram for JCPNetClass Transition extends NodeThe attributes vars represents the set of variables of the transition, including any variable which occurs in the guard expression and any input arc expressions of the transition. Even though the information attribute vars carries is implied by the guard expression and input arc expressions, we insist attribute vars should be specified explicitly for simplicity and efficiency purposes. Usually vars is a very small set.Each token variable can be bound to any token in the corresponding input place. Operation getBindings ( ) generate the all possible combinations of variable bindings. Operation isEnabled ( ) indicates whether the transition is enabled with a binding of vars. If any input token is time stamped and the time stamp has not reached the current time, then even the transition is enabled, it is not yet ready to fire. Operation isReady ( ) indicates the readiness of the transition. When a transition is enabled and ready, it can be fired. The firing of the transition will consume tokens from each input place according to the binding and input arc inscriptions, and generate tokens according to binding and the output arc inscriptions then add tokens into each output place.Class ArcAn arc connects its source node to its target node. A node is either a place or a transition. The source node and target node of an Arc should never be of the same type. Otherwise an IllegalArcException will be thrown.Class CPNetAttribute places represents the finite set of places, while Attribute transitions represents the finite set of transitions. Operation getOGraph ( ) constructs the occurrence graph of the CPNet with the current marking. Operation getPlaceByLabel ( ) and getTransitionByLabel ( ) are used to retrieve the reference of a place or transition by its label. Operation print ( ) display the structure of the CPNet. Operation printMarking ( ) is a static method used to display the content of a particular marking of the CPNet.Class OGraphNode extends NodeEach node of an occurrence graph represents a reachable marking from the initial marking of the CPNet. Attribute id is used to refer to a node for convenience reasons. In depth-first search of graphs [algorithm text], nodes are colored to indicate their state during the search. Each node is initially white. It is grayed once upon it has been discovered in the search, then it is blackened when all its adjacent nodes have been examined (also called the node is finished). Depth-first search generates a depth-first forest. During the search, each node is also time stamped. There are two time stamps: attribute dtime records when the node is first discovered (and grayed), and attribute ftime records when the search finishes examining all output arcs of the node. Attribute parent refers to the parent of the node in the search tree.Class OGraphArcWhen an enabled binding element fires, the state of the CPNet transfers from one marking (denoted by attribute source) to another marking (denoted by attribute target). An object of class OGraphArc represents the transferring between two reachable markings.Class OGraphAttribute nodes represent the finite set of nodes of the occurrence graph. Attribute net refers to the CPNet the occurrence graph belongs to.Operation DFS_Visit(root) performs a depth-first search visit starting from OGraphNode root. Operation isReachable (node1, node2) checks if the marking corresponding to node2 is reachable from the marking corresponding to node1. Operation isHome(home) examines if home represents a home marking.3.CPNET OCCURRENCE GRAPHWe have already indicated the importance of state-based formal reasoning, which is supported by state space methods. Most state space methods investigate the reachable states by constructing an occurrence graph (also known as reachability graph, O-graph for short). Basically an O-graph is a directed graph consisting of all the states the system can reach from its given initial state. Each node of the graph represents a state of the system, and each directed arc is labeled with the action that leads to the next state. An O-graph provides an interleaving semantics of a system: two or more actions occurring simultaneously are treated as an un-ordered sequence. Readers who are interested in the formal definition of O-graph are referred to [Jensen v2].Now we discuss O-graph construction algorithm, which is the key to the state space method using CPNet. When we have a CPNet where all variables (in the arc expressions and transition guards) have finite color sets, the O-graph is finite iff (if and only if) all places are bounded. Below we recapture the abstract algorithm to construct the O-graph given in [Jensen v2]. The algorithm halts iff the O-graph is finite. Otherwise the algorithm continues for ever, producing a larger and larger subgraph of the O-graph.Waiting := ØNode(M)repeatselect a node M1∈Waitingfor all (b, M2) ∈ Next (M1) dobeginNode(M2)Arc (M1, b, M2)endWaiting := Waiting – {M1}until Waiting = ØFig .2. An abstract O-graph construction algorithmWaiting is a set of nodes. It contains those nodes for which we have not yet found the successor. Node (M) is a procedure that creates a new node M and adds M to Waiting. If M is already a node, the procedure has no effect. Analogously, Arc (M1, b, M2) is a procedure that creates a new arc with source M1, binding element b, and destination M2. If it is already in existence, the procedure has no effect. We use Next (M1) to denote the set of all possible “next moves”: binding element and the next reachable marking from marking M1.Now we present our implementation of the algorithm, which shows a number of additional key points which are not obvious in the abstract algorithm.refer to CPNet.java in JCPNet.Fig. 3a. Get all bindings of a transition, where Set.xproduct is listed in Fig. 3b.Fig. 3b. Set.xproduct4.EXAMPLE APPLICATIONSWe present five example applications in this section. “Arithmetic Adder” is a simple example showing data manipulation in CPNets. “Dining philosophers” and “Distributed database” have also been discussed and analyzed in [Jensen v1] and [Jensen v2], here we use them to test the correctness of our implementation of CPNet O-graph construction algorithm. “Resource allocation” is a classical problem in operating system, which is used to illustrate how JCPNet can be used to detect deadlocks automatically. JCPNet has also been applied intensively in the specification, design and analysis of service-oriented distributed systems.JCPNet has several advantages over CPN tools: (1) the content of each node in an O-graph can befound more conveniently, while in CPN tools you have to write a lot of state space queries; (2) theO-graph can be generated automatically in the input format of GraphViz [GraphViz] for visualization; (3) JCPNet also enables CPNet modelers to utilize CPNet algorithms as Java APIs rather than solely relying on external tools.4.1Arithmetic AdderFig. 4 shows a simple example which illustrates data manipulation in CPNet.Declaration:Color INT = int;var x, y, z: INT;fun sum(i, j , k) = i + j + k;Fig. 4. CPNet model of an arithmetic adder4.2Dining PhilosophersDining philosophers is a classical problem of concurrency and conflicts, which are captured in the CPNet model in Fig. 5. The model is implemented by DiningPhilosophers.java in JCPNet.Declarations:val n = 5;color PH = index ph with 1..n;color CS = index cs with 1..n;var p: PH;fun Chopsticks(ph(i)) = 1`cs(i) ++ 1`cs(if i=n then 1 else i+1);Fig. 5. CPNet model of dining philosophers4.3Distributed DatabaseFig. 6 shows the CPNet model of a distributed database where data replication is enabled and data consistency is enforced. The model is implemented by DistributedDB.java in JCPNet.Declaration:color DBM = index d with 1..n;color PR = product DBM * DBM;fun diff(x,y) = (x<>y);color MES = subset PR by diff ;color E = with e;fun Mes(s) = PR.mult(1`s, DBM.all() – 1`s);var s, r: DBM;Fig. 6. CPNet model of distributed database4.4Resource AllocationThe CPNet model show in Fig. 7 shows the problem of allocating two resources r1 and r2 to two processes P1 and P2, only one resource is allowed to be allocated to a process at a time, and the two resources are allocated to each process in different order. This allocation scheme leads to one deadlock, which has been detected automatically by the state space analysis reported in Fig. 8. The model is implemented by ResourceAllocation.java in JCPNet.Declaration:color E = with e;Fig. 7. CPNet model of resource allocation scheme A### The Ocurrence Graph of CPNet Resource Allocation has 6 nodesNode # 1 with marking:Content of marking:p11 : ep21 : eResource1 : eResource2 : e--------------------------------------Input Arcs:BE = [work1, [e]]FROM Node # 4BE = [work2, [e]]FROM Node # 6Output Arcs:BE = [allocateR1ToP1, [e]]TO Node # 2BE = [allocateR2ToP2, [e]]TO Node # 3Node # 2 with marking:Content of marking:p12 : ep21 : eResource2 : e--------------------------------------Input Arcs:BE = [allocateR1ToP1, [e]]FROM Node # 1Output Arcs:BE = [allocateR2ToP1, [e]]TO Node # 4BE = [allocateR2ToP2, [e]]TO Node # 5Node # 3 with marking:Content of marking:p11 : ep22 : eResource1 : e--------------------------------------Input Arcs:BE = [allocateR2ToP2, [e]]FROM Node # 1Output Arcs:BE = [allocateR1ToP1, [e]]TO Node # 5BE = [allocateR1ToP2, [e]]TO Node # 6Node # 4 with marking:Content of marking:p13 : ep21 : e--------------------------------------Input Arcs:BE = [allocateR2ToP1, [e]]FROM Node # 2Output Arcs:BE = [work1, [e]]TO Node # 1###Node 5 is a TERMINAL node ###Node # 5 with marking:Content of marking:p12 : ep22 : e--------------------------------------Input Arcs:BE = [allocateR2ToP2, [e]]FROM Node # 2BE = [allocateR1ToP1, [e]]FROM Node # 3Output Arcs:Node # 6 with marking:Content of marking:p11 : ep23 : e--------------------------------------Input Arcs:BE = [allocateR1ToP2, [e]]FROM Node # 3Output Arcs:BE = [work2, [e]]TO Node # 1### number of DEAD markings (TERMINAL nodes) = 1Fig. 8. Occurrence graph of the CPNet model for resource allocation.Node #5 indicates a deadlock which occurs when resource r2 has beenallocated to process P1 and resource r1 has been allocated to process P2.The deadlock can be avoided by (1) allocate all resources to a process at the same time (shown in Fig. 8); or (2) allocate one resource to a process at a time, but allocate the resources to each process in the same order (shown in Fig. 9).Fig. 8. Allocate all resources at the same time to a process. No deadlocks.Fig. 9. Allocate resources (one resource to one process at a time) inthe same other to each process. No deadlocks.4.5Service Oriented Distributed SystemsA subclass of CPNet, WSPNet, has been created as the unified specification model for service compositions and behavioral interface (conversation protocols). WSPNet supports incoroporation of stateful partners, verification of service compositions, derivation of behavioral interfaces, and verification of application-level protocol involving services [Yi icws][atpn report][protocol verification].5.CONCLUSION AND FUTURE DIRECTIONSIn this paper we have presented a new software tool JCPNet supporting CPNet, which has a potential to enable CPNet model to be used more widely and flexibly. An overview of the implementation of JCPNet is given, which highlights the key points of our implementation. Moreover, CPNet model and JCPNet tool are applied to a number of examples including specification and analysis of service oriented distributed systems.In the future, we plan to add more advanced features to JCPNet, such as automatically importing CPNet from CPN tools, and alleviating the state space explosion problem [State explosion][Sweep-line] [Incremental state space].REFERENCES[Intro to MDA]An introduction to Model Driven Architecture. http://www-/developerworks/rational/library/3100.html[Yi dasd] X. Yi and Krys J. Kochut."Process Composition of Web Services with Complex Conversation Protocols: a Colored Petri Nets Based Approach", Proceedings of the Design, Analysis, and Simulation of Distributed Systems Symposium, pp. 141-148, Adavanced Simulation Technology Conference 2004, April 2004, Washington DC[Yi icws] X. Yi and Krys J. Kochut."A CP-nets-based Design and Verification Framework for Web Services Composition", Proceedings of 2004 IEEE International Conference on Web Services, pp. 756-760, July 2004, San Diego, California[JCPNet website]JCPNet: A Java Colored Petri Nets Modeling and Analysis Tool./~xyi/jcpnet.html[Jensen v1, v2, v3] K. Jensen. Colored Petri Nets Basic Concepts, Analysis Methods and Practical Use, Volume 1, 2, 3 second edition, 1996[Incremental state space] Glen Lewis, C. Lakos. Incremental State Space Construction for Coloured Petri Nets. ICATPN 2001, LNCS 2075, pp. 263-282, 2001[CPN practitioner’s guide] L.M. Kristensen, S. Christensen, K. Jensen: The Practitioner's Guide to Coloured Petri Nets. International Journal on Software Tools for Technology Transfer, 2 (1998), Springer Verlag, 98-132.[CPNet and sys dev] Lars M. Kristensen, Jens B. Jorgensen, and Kurt Jensen. Application of Coloured Petri Nets in System Development. In Lecture on Concurrency and Petri Nets, Jorg Desel, Wolfgang Reisig and Grezegorz Rozenberg (Eds.), Springer, LNCS 3089, 626-685.[Algorithm text] T. Cormen, C. Leiserson, R. Rivest, C. Stein. 2001. Introduction to Algorithms. Second edition. MIT Press.[atpn report ] X. Yi and Krys J. Kochut,"Specification and Analysis of Service-Oriented Distributed Systems using Colored Petri Nets: Algorithms and Tools", UGA computer science department technical report, Nov. 2004. /~xyi/atpnTR.pdf[SML] Standard ML’97. /sml97.html[GraphViz] Graphviz - Graph Visualization Software /[Sweep-line method] Thomas Mailund, and Michael Westergaard. Obtaining Memory-Efficient Reachability Graph Representations Using the Sweep-Line Method. LNCS 2988. Springer-Verlag, 2004.[State explosion problem] A. Valmari. The State Explosion Problem. In Lectures on Petri Nets I: Basic Models, volume 1491 of Lecture Notes in Computer Science, pages 429–528. Springer-Verlag, 1998.。